Associate Director - Application Security

S&P Global • New York, NY

7h

About The Position

The Associate Director - Application Security will join S&P Global’s SGA Application Security team, a strategic security partner spanning Application Security, DevSecOps, Exposure Management, and AI Security. The team uses automation-first approaches, partners closely with developers, and continuously learns about emerging technologies. The role contributes to enterprise-wide security transformation initiatives and addresses complex security challenges affecting global engineering teams.

The position leads application security assessments and helps embed security controls into developer workflows and the software development lifecycle. It also provides security design guidance for applications, APIs, and cloud services; develops AI-enabled security tools and automations subject to enterprise governance standards; and partners across engineering, product, cloud, and risk functions to address systemic risks. The role provides technical leadership and mentorship and contributes to enterprise standards, procedures, and audit-ready documentation.

Requirements

• Bachelor's degree in Cybersecurity, Computer Science, or Engineering.
• At least 6 years of experience in Application Security, DevSecOps, or secure software.
• Proficiency in application security testing methodologies including SAST, SCA, DAST, threat modeling, and CI/CD security integration.
• Experience integrating security controls into GitHub, Azure DevOps, Jenkins, or cloud-native delivery environments.
• Experience using generative AI and AI-assisted development tools to build custom security tooling, scripts, integrations, or automations.

Nice To Haves

• Experience with Model Context Protocol (MCP), AI agents, agentic architectures, tool calling, and retrieval-augmented generation for secure enterprise AI integration.
• Experience with cloud application security across AWS, Azure, and GCP, including cloud-native security controls in multi-cloud environments.
• Proficiency in Python, PowerShell, or equivalent scripting languages to automate and improve security operations at enterprise scale.
• Experience with software supply chain security, including dependency governance, artifact management, provenance validation, and trusted package consumption.
• Ability to communicate complex security risks to senior stakeholders and drive remediation across distributed engineering teams.
• Experience providing technical mentorship within security or engineering teams.

Responsibilities

• Lead application security assessments using SAST, SCA, DAST, API security, secrets detection, and threat modeling to identify and mitigate enterprise vulnerabilities.
• Integrate security controls into GitHub, Azure DevOps, Jenkins, and cloud-native developer workflows, including risk-based quality gates.
• Conduct threat modeling and security design reviews for applications, APIs, and cloud services, and advise on secure architecture decisions.
• Design and implement AI-enabled application security tools, agents, and automations to improve security testing, triage, and remediation while meeting enterprise governance standards.
• Partner with engineering, product, cloud, and risk stakeholders to resolve systemic application risks and establish scalable SDLC security controls.
• Provide technical leadership and mentorship to security analysts and engineering partners.
• Contribute to enterprise standards, procedures, and audit-ready documentation.

Benefits

• Health care coverage for physical and mental well-being.
• Generous time off.
• Career development and learning resources.
• Retirement planning.
• Continuing education program with a company-matched student loan contribution.
• Financial wellness programs.
• Family-oriented benefits and perks.
• Retail discounts.
• Referral incentive awards.
• Eligible for an annual incentive plan.

What This Job Offers

• Job Type: Full-time
• Career Level: Director